topic Re: "how to cancel the data source" in Splunk Search

"how to cancel the data source"

johnsmithcy — Fri, 18 Jan 2019 06:59:17 GMT

the host monitoring keep fetching the CPU data.
I want to cancel the date source

Re: "how to cancel the data source"

dkeck — Fri, 18 Jan 2019 07:19:15 GMT

Hi,

depending from where you are getting your data you just have to disable the stanza in inputs.conf on your forwarder to stop it from sending.

Re: "how to cancel the data source"

johnsmithcy — Fri, 18 Jan 2019 07:23:16 GMT

i configure it through "add data"--> "monitor" --> local performance monitoring

Re: "how to cancel the data source"

MoniM — Fri, 18 Jan 2019 07:24:52 GMT

Hi @johnsmithcy,

you can use the below command in CLI:-

sourcetype=my_sourcetype | delete
For more details check this http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk

Re: "how to cancel the data source"

johnsmithcy — Fri, 18 Jan 2019 07:29:30 GMT

thank you. any graphical interface method?
I am using windows version

Re: "how to cancel the data source"

dkeck — Fri, 18 Jan 2019 07:30:27 GMT

Then try to find it under settings-> data inputs -> local Windows or local perfomance monitoring 🙂 than click delete or disable

Re: "how to cancel the data source"

MoniM — Fri, 18 Jan 2019 08:19:01 GMT

Okay, so you can delete your sourcetype by following below steps:-
1. login to your splunk instance and goto settings
2. In data, goto sourcetypes and search for your sorectype(which you created for your "CPU" input).
3. delete that sourcetype.

Let me know if it works.

Re: "how to cancel the data source"

johnsmithcy — Fri, 18 Jan 2019 08:54:14 GMT

it works, thx